Quantum bit string sealing 
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Though it was proven that secure quantum sealing of a single classical bit is impossible in principle, 
here we propose an unconditionally secure quantum sealing protocol which seals a classical bit string. 
Any reader can obtain each bit of the sealed string with an arbitrarily small error rate, while reading 
the string is detectable. The protocol is simple and easy to be implemented. The possibility of using 
this protocol to seal a single bit in practical is also discussed. 

PACS numbers: 03.67.Dd, 03.67.Hk, 89.70.+C 



I. INTRODUCTION 

Quantum sealing is a young member of quantum cryp- 
tography. But classical sealing has entered our everyday 
life for centuries. For example, people sometimes put im- 
portant letters or documents inside an envelope, and seal 
the envelope by melting wax over the cover flap. Ad- 
ditionally, the wax can be impressed with an image to 
indicate authenticity, such as a family crest. If the wax 
was broken or the image looks unmatched, then someone 
may have opened the envelope and read the document. 
Thus it provides a method to check whether the secret 
document remains secure or not. Obviously it is useful to 
expand the idea of classical sealing to the digital world. 
However, just as other classical cryptographic protocols, 
no classical sealing protocol can be unconditionally se- 
cure. This is because there is no no-cloning theorem of 
classical data to prevent a cheater from copying and read- 
ing all the data without being detected. 

On the other hand, quantum cryptography has made 
significant progress in the last two decades. Many quan- 
tum protocols, e.g. the conjugate codingjlj] and the well- 
known quantum key distribution 0,0,0], surpassed their 
classical counterparts as their security is rested on the ba- 
sic laws of quantum mechanics and can be uncondition- 
ally secure. Therefore it is natural to ask whether the 
quantum no-cloning theorem!^ can make secure quan- 
tum sealing possible. Bechmann-Pasquinucci 6J proposed 
the first quantum sealing protocol in 2003 which seals a 
single classical bit with a three-qubit state, shortly fol- 
lowed by Chau0 with a protocol which seals quantum 
data with quantum error correcting code. In 2005, Singh 
and Srikanth^S] extended the idea of Ref. 6] into a many- 
qubit majority voting scheme, and associated it with se- 
cret sharing to improve the security. These protocols 
can be divided into two types. The first two are perfect 
quantum sealing in the sense that a reader can obtain 
the sealed data with certainty. The last one is imperfect 
for the reader cannot do so accurately. 

However, as pointed out by the authors themselves, 
the protocols in Refs.0, 01 are insecure against collec- 
tive measurements. More general, it was proven 9] that 
secure perfect quantum sealing is impossible in princi- 
ple. With collective measurements, the reader can always 



read the data without being detected. Very recently, the 
general models of imperfect quantum sealing were stud- 
ied by He[i3 and Chau^l with different approaches, 
showing that they are also insecure for sealing a single 
classical bit. The reader can always cheat successfully 
with a non-trivial probability. Consequently, the major- 
ity voting scheme in Ref.Q is insecure alone, if it is not 
associated with secret sharing. That is, its security has 
to fall back on that of the secret sharing scheme. The 
existence of these three no-go proofs seems to put an end 
to the development of quantum sealing. 

This is not true. Though secure quantum sealing of 
a single classical bit is impossible, it will be shown in 
this paper that quantum sealing of a classical bit string 
can be unconditionally secure. At the first glance, this 
result seems odd since classical reasoning suggests that 
secure bit string sealing implies secure single bit sealing 
and hence conflicts with the above no-go proofs. But 
as pointed out by Kent 'l 2], reductions and relations be- 
tween classical cryptographic tasks need not necessarily 
apply to their quantum equivalents. Similar situation 
happened before in quantum cryptography. Though the 
possibility of unconditionally secure quantum bit com- 
mitment was excluded by the Mayers-Lo-Chau no-go 
theoremlH Kent found that secure quantum bit 
string commitment protocol exist s[l^. In this paper, a 
secure quantum bit string sealing protocol will be pro- 
posed. It achieves the following goal: each bit of the 
string can be obtained by the reader with an arbitrarily 
small error rate, while reading the string can be detected 
except with an exponentially small probability. The sig- 
nificance of the protocol lies in three major aspects. (1) 
In practical, it is obvious that sealing a long bit string is 
much more useful than sealing a single bit. (2) As shown 
by Gordon Worley Illjl^, secure quantum sealing, if ex- 
ists, has wide applications in many different fields, e.g. 
loose bit commitment, binary semaphores, eavesdropping 
detection and protective packaging. Therefore our pro- 
tocol can re-open new venues for these applications that 
once closed by the no-go proofs. (3) The protocol is very 
simple to be implemented with the techniques available 
nowadays. In additional, the protocol also makes it possi- 
ble to implement "computationally" secure quantum bit 
sealing in practical. 
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II. THE PROTOCOL 

Quantum bit string sealing can be summarized as the 
following two-party cryptographic problem. A sender Al- 
ice encodes an n-bit string with quantum states. Any 
reader Bob can obtain the string from these states, while 
reading the string should be detectable. Clearly quan- 
tum bit sealing can be viewed as the special case where 
n = 1. 

Consider the ideal case without transmission error. Let 
e (0 < e < 7r/4) and a (0 < a < 1/2) be two fixed 
constants. We propose the following quantum bit string 
sealing protocol: 

Sealing: To seal a classical n-bit string b = bib2...bn 
{hi G {0, 1}), AHce randomly chooses 9i (— ^ 9i ^ 
Q/n") and encodes each bit hi in a qubit state = 
cos^i \bi) -I- sin^i She makes these n qubits publicly 
accessible to the reader, while keeping all 9i [i = 1, n) 
secret. 

Reading: When Bob wants to read the string h, he 
simply measures each qubit in the computational basis 
{|0) , and denotes the outcome as \b^). He takes the 
string h' — b'ib'2---b',^ as b. 

Checking: At any time, Alice can check whether the 
sealed string b has been read by trying to project the «-th 
qubit into cos^^ -|- sin^^ [6^). If all the n qubits can 
be projected successfully, she concludes that the string b 
is still unread. Otherwise if any of the qubits fails, she 
knows that b is read. 

Obviously this new protocol achieves the following 
goal: each bit sealed by Alice can be read success- 
fully by Bob, except with a probability not greater than 
e = sin^(0/n"). Thus by increasing n, the reading error 
rate e can be made arbitrarily small. 

In the next section it will be proven that the protocol 
also guarantees that: if the string was read, it will be 
detected by the checking process except with an expo- 
nentially small probability. 

III. PROOF OF SECURITY 

When the reader Bob measures the i-th qubit in the 
basis {|0) , |1)}, the qubit collapses to We may 

even assume Bob to be malevolent, that he replaces 
each qubit with another quantum state lipl) after read- 
ing it, so that his chance to pass the checking with- 
out being detected might be increased. Due to the no- 
cloning theorem of quantum states 0, Bob cannot deter- 
mine and copy the state \^pi) exactly since he does not 
know 6i. He cannot even be sure whether b'^ = hi or 
not after he read Thus he has to pick another 9[ 

(— G/n" ^ 9[ ^ 0/n") himself and prepares the fake 
state as IV'i) — cos9[ \b[) + sn\9[ Since the case 

h[ = hi (or b[ = bi) will occur with the probability 
cos^ 9i (or sin^ 9i), the fake state can be projected to 



= cos9i \bi) + sm9i successfully in the checking 
process with the probability 

= cos^ 9, cos^ {e,-9[)+ sin^ 9, sin^ {9, + 9'^). ( 1 ) 

When 9i is evenly distributed among the range 
[— 0/n", 0/n"], the average of pi is 

Its maximum can be reached when 0^ = 0. That is, it 
is better for Bob not to fake the state, but simply leaves 
the i-th qubit as it is after measuring it. In this case 

Pi = l- ^sm^29,. (3) 

Therefore the total probability for Bob to read k = f]n 
(0^/3^1) bits without being detected is 

P=f[{l~lsm'29.,), (4) 

i—ii 

which drops exponentially as k n, and vanishes when 
n ^ oo as long as < a < 1/2. 

However, in the more general case Bob may not read 
the string with the measurement suggested by the pro- 
tocol. He may not even want to learn each hi individu- 
ally, but tries to perform collective measurement on the 
whole system ^l* = 'tjji'ijj2 ■■■ipn so that he can obtain some 
global properties of the string (e.g. parity, weight etc.). 
In this case, let H denotes the 2" dimensional Hilbert 
space where ^ lives in. Suppose that ^ finally collapses 
into a subspace V after Bob performs certain POVMs. 
Let {v} and m be the computational basis and the di- 
mensionality of V respectively. Then no matter how the 
details of Bob's cheating strategy could be, the amount 
of information Bob obtained is bound by 

k = log2 2" - log2 TO. (5) 

Meanwhile, the final state of is 

l*')^^El^)("l*)' (6) 
where the normalization constant 

vev 

Again, it can be shown that it is better for Bob not to 
fake the state. Then \'^') can be projected to the initial 
state 1^") = iV'i) I "02) ■■■ iV'n) successfully in the checking 
process with the probability 

^ = i(*i*')i' = EK"|*)|'- (8) 

v£V 
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Since \ipi) = cosOi \bi) + svnOi and {«} is the compu- 
tational basis, for any v we have 

n 

\{v\^)\^ ^WcosH,. (9) 

1=1 

Therefore the total probability for Bob to obtain k bits 
of information without being detected is 

n n 

P ^ 771- Jlcos^ei; = 2~'=]^2cos^6i,. (10) 

i=l i=l 

which also drops exponentially as k —>■ n, and vanishes 
when 77 — > cxD as long as < a < 1/2. 

As a result, no matter Bob reads the string with in- 
dividual or collective measurements, the probability for 
him to avoid from being detected will always be expo- 
nentially small as the amount of information he obtained 
increases. Thus the protocol is unconditionally secure. 

IV. DISCUSSIONS 



If the whole string becomes perfectly retrievable, then 
each bit of the string is perfectly retrievable too. From 
the proof in Ref.j^ we can see that if Bob reads every 
single bit with collective measurements, the disturbance 
will rigorously equal to zero. Thus the total detecting 
probability will not be piled up but still equal to zero. 
Therefore, though the error rate e can be made arbitrar- 
ily small, we cannot expect to find methods to make it 
completely vanished. 

On the other hand, as pointed out in Ref . [l0| . the no- 
go proof of imperfect quantum single bit sealing does not 
cover the case of string sealing. More rigorously, in our 
protocol by expanding the state j^*) in the computational 
basis of the global Hilbert space H, we can see that 
covers all eigenvectors of H. That is, the "sub"-space sup- 
ported by 1 5") is exactly the space H itself. Therefore the 
spaces supported by different states which encode differ- 
ent strings completely overlap with each other. No mea- 
surement can distinguish them apart without disturbing 
the states seriously. Thus the cheating strategy in the no- 
go proofs of imperfect quantum single bit sealing^^ ^| 
does not apply here. 



A. Relationship with the no-go proofs 

The existence of this secure quantum bit string sealing 
protocol does not conflict with the no-go proofs of quan- 
tum single bit sealing^, 10, 11] . In fact, our quantum 
bit string sealing protocol can be viewed as the assembly 
of n imperfect quantum single bit sealing process. From 
the security proof in the above section, we can see that 
if Bob reads only few bits, the disturbance on the quan- 
tum states is small that it is almost undetectable. In this 
sense, the sealing of each single bit of the string is inse- 
cure. Also, it is insecure to use the global properties of 
the string (e.g. parity, weight etc.) to implement single 
bit sealing. But if Bob reads a large number of bits, the 
small disturbance on every single qubit will be piled up 
together so that the detecting probability will increase 
dramatically. Hence the sealing of the whole string can 
be secure. 



B. The protocol is an imperfect sealing one 

The sealed string can only be read with a non-zero 
error rate e = sin^(0/77"). We cannot associate the pro- 
tocol with classical error-correcting codes or any other 
method to make the string perfectly retrievable. This 
is because the above security proof is based on the fact 
that Bob has no pre-knowledge on the string and the 
quantum states. If he is provided with a certain classical 
error-correcting code or anything relevant with the sealed 
string, he may have other methods to construct his col- 
lective measurements so that the security proof may not 
be valid any more. In fact, it is trivial to show that the 
no-go proof of perfect quantum bit sealing^ can be gen- 
eralized to the case of perfect quantum bit string sealing. 



C. Implementability 

Our protocol can be executed as long as Alice has the 
probability to prepare each single qubit in a pure state, 
while Bob can perform individual measurement. No en- 
tanglement or collective measurement required. There- 
fore the protocol can be demonstrated and verified with 
the techniques available nowadays. Of course for practi- 
cal uses, storing quantum states for a long period of time 
is still a technical challenge today. But this is a problem 
which all quantum sealing protocols have to face. Our 
protocol may already be one of the simplest in all possi- 
ble quantum bit string sealing protocols. 



V. SEALING A SINGLE BIT IN PRACTICAL 

Though secure sealing of a single bit is impossible in 
principle, if a protocol can be found in which reading 
the bit dishonestly is much more difficult than doing so 
honestly, it will still be valuable in practical. The no- 
go proof of imperfect quantum bit sealing[l3 leaves a 
clue on how to construct such a protocol. As pointed 
out in that reference, quantum sealing protocol generally 
contains the following feature: Bob knows an operation 
P and two sets Gq, Gi , such that if he applies P on the 
quantum system that seals the bit and the outcome is 
g € Go (or g € Gi), he should take the value of the sealed 
bit as (or 1). Though in principle we cannot exclude 
this feature from the protocol (otherwise the sealed bit 
becomes irretrievable), we can keep the dishonest reader 
from knowing P, Gq and Gi too easily. The method is: 
Alice can seal the description of P, Gq and Gi with the 
quantum string sealing protocol. If Bob wants to decode 
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the sealed bit correctly, he should read this sealed string 
first. Thus the status of the sealed bit can be checked by 
detecting whether the sealed string has been read. 

For example, Alice first encodes the following sentence 
into a classical binary bit string 

"Measure the last two qubits in the basis 
{cosl5° |0) + sinl5° |1) ,-sinl5° |0) + cosl5° |1}} 
and you will know the value of the sealed bit from 
their parity. Other qubits following this sentence 
are all dummy qubits. You can simply leave them 
alone." 

Then she seals it with our quantum string sealing proto- 
col, and provides Bob the qubits encoding this sentence, 
followed by a large number of qubits where only the last 
two are actually useful. 

However, this bit sealing method is still insecure in 
principle. This is because any given classical n-bit string 
can be decoded into one sentence only, and the mean- 
ing of the sentence will reveal the value of the sealed bit 
unambiguously. As long as a dishonest Bob knows the 
length n of the sealed string, he can study all the 2" pos- 
sible classical n-bit strings, decode them into sentences, 
and divide these sentences into Go and Gi (of course 
there will also be tons of meaningless sentences. Bob can 
simply leave them alone). Then as described in Ref . [lo|| . 
he needs not to know the content of the sealed sentence 
exactly. He simply constructs a proper collective mea- 
surement to determine whether the sentence belongs to 
Go or Gi. Thus he will know the sealed bit from the n 
qubits without disturbing them too much. 

But if n is sufficiently large, the number of possible 
sentences will be enormous. There could be sentences as 



simple as 

"It is 0. Ignore the rest qubits." 

But there are also sentences like 

"Decode the bits following this sentence as a 
bitmap image and you will find clues to the 
value of the sealed bit" 

or 

"Go to the main library. Find the book on the 
top — left of the last shelf . Turn to the last page, 
and count how many times the letter K occurs 
in the 3rd line " 

or even 

"Dig my backyard until you find water. Count 

how many feet you digged. Then divide it by the 

height of the tree in the north corner " 

In this case, even if a dishonest Bob has the technique 
to perform collective measurements on the n-qubit sys- 
tem, in practical it is nearly impossible to check all these 
sentences and find out the bit value they are correspond- 
ing to. On the other hand, an honest Bob needs not to 
worry about this. He can simply read the sealed string 
honestly and then follows the instruction to decode the 
sealed bit. In this sense, such sealing can be viewed as 
a kind of "computationally" secure quantum single bit 
sealing in practical. 

I would like to thank Helle Bechmann-Pasquinucci for 
useful discussions. 
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